Manage keys

This document explains how to manage keys when using Concrete, introducing the key management API for generating, reusing, and securely handling keys.

Concrete generates keys lazily when needed. While this is convenient for development, it's not ideal for the production environment. The explicit key management API is available for you to easily generate and reuse keys as needed.

Definition

Let's start by defining a circuit with the following example:

from concrete import fhe

@fhe.compiler({"x": "encrypted"})
def f(x):
    return x ** 2

inputset = range(10)
circuit = f.compile(inputset)

Circuits have a keys property of type fhe.Keys, which includes several utilities for key management.

Generation

To explicitly generate keys for a circuit, use:

circuit.keys.generate()

Generated keys are stored in memory and remain unencrypted.

You can also set a custom seed for reproducibility:

circuit.keys.generate(seed=420)

Do not specify the seed manually in a production environment! This is not secure and should only be done for debugging purposes.

Serialization

To serialize keys, for tasks such as sending them across a network, use:

serialized_keys: bytes = circuit.keys.serialize()

Keys are not serialized in encrypted form. Please make sure you keep them in a safe environment, or encrypt them manually after serialization.

Deserialization

To deserialize the keys back after receiving serialized keys, use:

keys: fhe.Keys = fhe.Keys.deserialize(serialized_keys)

Assignment

Once you have a valid fhe.Keys object, you can directly assign it to the circuit:

circuit.keys = keys

If assigned keys are generated for a different circuit, an exception will be raised.

Saving

You can also use the filesystem to store the keys directly, without managing serialization and file management manually:

circuit.keys.save("/path/to/keys")

Keys are not saved in encrypted form. Please make sure you store them in a safe environment, or encrypt them manually after saving.

Loading

After saving keys to disk, you can load them back using:

circuit.keys.load("/path/to/keys")

Automatic Management

If you want to generate keys in the first run and reuse the keys in consecutive runs, use:

circuit.keys.load_if_exists_generate_and_save_otherwise("/path/to/keys")